Analysis
- max time kernel
84s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
31/07/2026, 14:06
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-07-31_908b7a51c424818dd96c0c4397064fb6_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_hi.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-31_908b7a51c424818dd96c0c4397064fb6_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_hi.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 2026-07-31_908b7a51c424818dd96c0c4397064fb6_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_hi.exe
- Size 3.3MB
- Sample260731-redlyavalg
- SHA256 e7945ffb3a0f7b37a0ac5a2d65c107de017b80dfb1ef9e4fe018157c9e23a290
- MD5 908b7a51c424818dd96c0c4397064fb6
- SHA1 91f2f7c67ff30a052883ae4501abcd3dd73ec5ea
- SHA512 2dc1a5ef4a656963257890e760a5c272301ba47a7f3895d92cc3df5cd8dd2381fd8246dcb4c138527ea85cba0748af1092f4909140d6b322b22540822fdd5a63
- SSDEEP 98304:wVONVnIGjYIabjKoh9WsVfwUjoPrtTcr+:3nFQ1oTtT4+
- TLSH T176F53911B6A48F21E07B81B599E29756E9733C410F2187CB5381BF6C3E33AD19A76723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 12 IoCs
resource yara_rule behavioral1/memory/956-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/3472-7-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00090000000244eb-6.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b3d-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002161d-1271.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000d00000001dab3-1364.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x001400000001dab3-1426.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/956-1488-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x001f00000001dab3-1513.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/3472-1521-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000500000001e857-1871.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000001e50f-2042.dat INDICATOR_EXE_Packed_ASPack - Executes dropped EXE 1 IoCs
pid Process 3472 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-31_908b7a51c424818dd96c0c4397064fb6_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_hi.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-31_908b7a51c424818dd96c0c4397064fb6_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_hi.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE 2026-07-31_908b7a51c424818dd96c0c4397064fb6_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_hi.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe$$ 2026-07-31_908b7a51c424818dd96c0c4397064fb6_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_hi.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe$ 2026-07-31_908b7a51c424818dd96c0c4397064fb6_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_hi.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe$ 2026-07-31_908b7a51c424818dd96c0c4397064fb6_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_hi.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE$ 2026-07-31_908b7a51c424818dd96c0c4397064fb6_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_hi.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-07-31_908b7a51c424818dd96c0c4397064fb6_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_hi.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-07-31_908b7a51c424818dd96c0c4397064fb6_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_hi.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 2026-07-31_908b7a51c424818dd96c0c4397064fb6_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_hi.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\PilotshubApp.exe 2026-07-31_908b7a51c424818dd96c0c4397064fb6_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_hi.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-07-31_908b7a51c424818dd96c0c4397064fb6_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_hi.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-07-31_908b7a51c424818dd96c0c4397064fb6_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_hi.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-07-31_908b7a51c424818dd96c0c4397064fb6_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_hi.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-07-31_908b7a51c424818dd96c0c4397064fb6_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_hi.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE$ 2026-07-31_908b7a51c424818dd96c0c4397064fb6_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_hi.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe$ patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 2026-07-31_908b7a51c424818dd96c0c4397064fb6_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_hi.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE patcher.exe File opened for modification C:\Program Files\Windows Mail\wab.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe$ 2026-07-31_908b7a51c424818dd96c0c4397064fb6_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_hi.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe$ 2026-07-31_908b7a51c424818dd96c0c4397064fb6_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_hi.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe$ 2026-07-31_908b7a51c424818dd96c0c4397064fb6_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_hi.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe$ 2026-07-31_908b7a51c424818dd96c0c4397064fb6_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_hi.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE 2026-07-31_908b7a51c424818dd96c0c4397064fb6_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_hi.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-07-31_908b7a51c424818dd96c0c4397064fb6_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_hi.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-07-31_908b7a51c424818dd96c0c4397064fb6_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_hi.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\fmui\fmui.exe 2026-07-31_908b7a51c424818dd96c0c4397064fb6_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_hi.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe patcher.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-07-31_908b7a51c424818dd96c0c4397064fb6_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_hi.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\TCUI-App.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe$ 2026-07-31_908b7a51c424818dd96c0c4397064fb6_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_hi.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeApp.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE 2026-07-31_908b7a51c424818dd96c0c4397064fb6_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_hi.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe$ 2026-07-31_908b7a51c424818dd96c0c4397064fb6_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_hi.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe 2026-07-31_908b7a51c424818dd96c0c4397064fb6_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_hi.exe File opened for modification C:\Program Files\7-Zip\7z.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe$ 2026-07-31_908b7a51c424818dd96c0c4397064fb6_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_hi.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe$ patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe$ patcher.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-07-31_908b7a51c424818dd96c0c4397064fb6_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_hi.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe$ patcher.exe File created C:\Program Files\7-Zip\7zFM.exe 2026-07-31_908b7a51c424818dd96c0c4397064fb6_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_hi.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe 2026-07-31_908b7a51c424818dd96c0c4397064fb6_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_hi.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-07-31_908b7a51c424818dd96c0c4397064fb6_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_hi.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-31_908b7a51c424818dd96c0c4397064fb6_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_hi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-31_908b7a51c424818dd96c0c4397064fb6_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_hi.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 956 2026-07-31_908b7a51c424818dd96c0c4397064fb6_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_hi.exe 3472 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_908b7a51c424818dd96c0c4397064fb6_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_hi.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-31_908b7a51c424818dd96c0c4397064fb6_amadey_cloudeye_cobalt-strike_darkgate_elex_glassworm_hi.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:956
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3472
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 3.3MB
- SHA256 e7945ffb3a0f7b37a0ac5a2d65c107de017b80dfb1ef9e4fe018157c9e23a290
- MD5 908b7a51c424818dd96c0c4397064fb6
- SHA1 91f2f7c67ff30a052883ae4501abcd3dd73ec5ea
- SHA512 2dc1a5ef4a656963257890e760a5c272301ba47a7f3895d92cc3df5cd8dd2381fd8246dcb4c138527ea85cba0748af1092f4909140d6b322b22540822fdd5a63
- SSDEEP 98304:wVONVnIGjYIabjKoh9WsVfwUjoPrtTcr+:3nFQ1oTtT4+
- TLSH T176F53911B6A48F21E07B81B599E29756E9733C410F2187CB5381BF6C3E33AD19A76723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$
- Size 3.6MB
- SHA256 c782dde5e3fe80a6d74994f8ec4b66fbd1d22075d82b3d5b8ec72c09ec42b9a9
- MD5 1d2f5bb1533a7952e6951b34d06ebb0b
- SHA1 dee3f757f2e096322a6bba9be11b1578dea55e66
- SHA512 29b937f1a9ae4deaa8c7e0b0d04bef61932d5d7fc8669306eec0245575849154fe633cb8ef988356570ac8e4769e81a25976e149d4389c732f536892a1492ed2
- SSDEEP 98304:wVONVnIGjYIabjKoh9WsVfwUjoPrtTcr+9E:3nFQ1oTtT4+9
- TLSH T16E063A11B7A88F61D07B817589E29756EA737C510F2187CB5380BB2D3E33AD19A36723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe$
- Size 3.4MB
- SHA256 a59feda1cd38d0885c78f1db52e48ad5984fe95de7cb5b3fc507cc5ce722fb40
- MD5 084d732c1529d0956396efdf54bf7ff4
- SHA1 1f7118c579653089ed823774c9de9b1877ed1242
- SHA512 2d5772d984e4c9da55b0896150d12aa37a15efeb767da79b027133d01a7f385e2c023242c377c394d677f5e412bca24cbaef77861603296db226869aecc27706
- SSDEEP 98304:wVONVnIGjYIabjKoh9WsVfwUjoPrtTcr+y:3nFQ1oTtT4+y
- TLSH T186F54A11B7A48B21D07B81B599E29796E9737C510F2087CB5380BF6D3E33AD19A36723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
- Size 3.7MB
- SHA256 7283b9df027cc959c7947624c52be5df679baeafd85acd81f7896fc142944087
- MD5 51d10ee2e966a35a6861f1d975aa598e
- SHA1 4db38151923e7e6c09b96c41232d2fb1fe60e937
- SHA512 a7915067fbedacfa467fabfe022612fac654ccce0deb8b5ded6d66c114e3f586f7c210241a52a4704436685335ec795272c5b02bcb40066693e28e905b633c32
- SSDEEP 98304:wVONVnIGjYIabjKoh9WsVfwUjoPrtTcr+VCqo:3nFQ1oTtT4+sqo
- TLSH T1D6064A11B7A48B61E07B81B5D9E29656E9737C410F2187CB5380BE2D3F33AD19A36723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe$
- Size 3.8MB
- SHA256 cf66eb6b9660361b308f54c414045a6a3737d841b99852ea9d32248585bc3a03
- MD5 d71d33898ee957c34e7ec161c78d237f
- SHA1 a74d47f379486f6d7df88a044fd01578026c0f49
- SHA512 29337d29227de8bdb916c04dd457ac86b834d155fde39b92894d703a5f96b92d56a125aa705d3e37cf4dbc0729bd6cb0ffedc6ee24ec816654577683c3502894
- SSDEEP 98304:wVONVnIGjYIabjKoh9WsVfwUjoPrtTcr+ddGl:3nFQ1oTtT4+HGl
- TLSH T171064A11B7A48B61E07B81B589E29656E9737C410F2087CB5380BF6D3F33AD19A76723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 3.8MB
- SHA256 d3422585cd84b1e6f8d4db3cbd8755399724aaa04b7d586fc4d55882f92b8962
- MD5 2a2b2a4544ab4df38eeedddcfab03d40
- SHA1 3dd59f87132118f62f047d3673477011acb4247d
- SHA512 0cdaca8973627d4a946a199082d87cd2d43c77d02e8e283e574c0a269aa53b631ece6f543769827568bc0ead0b721dbf3ec6824d6f8b8c951b79afdee00566de
- SSDEEP 98304:wVONVnIGjYIabjKoh9WsVfwUjoPrtTcr+Zjo:3nFQ1oTtT4+No
- TLSH T1A4062911B6A48B61D07B81B5C9E29696E9733C410F3187CB5385BF6C3E33AD19A36723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe$
- Size 3.3MB
- SHA256 3f8f909dbbf3b323eb769ed91f3b41d086991aeb3e65525bf91628f46c4025be
- MD5 4cde0475a18e06469a5eb3b117e47cc6
- SHA1 ad9d90bafbdb5d9cb3d3abf73d55b110aed51eb6
- SHA512 c69fc2dc0ea762f3649d5fad599935328358afa215451c633adc2d75d56f31f0f27590a7ba95c2e1cb23f2f3de0a47f49d0fb96ea37db784663ded608701195a
- SSDEEP 98304:wVONVnIGjYIabjKoh9WsVfwUjoPrtTcr+r:3nFQ1oTtT4+r
- TLSH T189F54911B6A48B21D07B81B5D9E29756E9737C810F2187CB5380BF6C3E33AD19A76723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe$
- Size 3.5MB
- SHA256 86a95cb846b3c99715fdd3b31c1c06ea53109602155a43acee1b4fb61e63f3cd
- MD5 db0cab680a236ab5324669c6fad3b518
- SHA1 3ecbbb9e38ab3e4d84cd26684ed3c33be52905f3
- SHA512 fe2a01ab0aca11370d71b35d99dd28384a6ecdfbe1a29930f7926c736304b63c6135efc0de0e32c059e1be51107625b340fb8a38f2e52d9213de168616f0203f
- SSDEEP 98304:wVONVnIGjYIabjKoh9WsVfwUjoPrtTcr+CuX:3nFQ1oTtT4+CA
- TLSH T105064A11B7A48B21D07B81B599E29766E9737C410F2187CB5380BF2D3E33AD19A76723
- MD5 SHA1 SHA512 SSDEEP TLSH